JKS: Extending a Self-Signed Certificate

Sometimes, you don’t have a PKI in place but you still need a key and a corresponding certificate to sign stuff (outside of the TLS context). And after the certificate in initially generated JKS file expires, you have few options – either generate an entirely new keypair or somehow “extend” the existing certificate. This is useful mostly for testing and internal systems but is still worth mentioning.

Extending certificates is generally not possible – once they expire, they’re done. However, you can have a new certificate with the same private key and a longer period. This sounds like something that should be easy to do, but it turns it isn’t that easy with keytool. Even with my favorite tool, keystore explorer, it’s not immediately possible.

In order to reuse the private key to have a new, longer certificate, you need to do the following:

1. Export the private key (with keytool & openssl or through the keystore-explorer UI, which is much simpler)
2. Make a certificate signing request (with keytool or through the keystore-explorer UI)
3. Sign the request with the private key (i.e. self-signed)
4. Import the certificate in the store to replace the old (expired) one

The last two steps seem to be not straightforward with keytool or keystore explorer. If you try to sign the request with your existing keystore keypair, the current certificate is used as the root of the chain (and you don’t want that). And you can’t remove the certificate and generate a new one.

So, you need to use OpenSSL:

x509 -req -days 3650 -in req.csr -signkey private.key -sha256 -extfile extfile.cnf -out result.crt

The extfile.cnf is optional and is used if you want to specify extensions. For example, when it comes to timestamping, the extension file looks like this:

extendedKeyUsage=critical,timeStamping

After that, “simply” create a new keystore and import the private key and the newly generated certificate. This is straightforward through the keystore-explorer UI, and much less easily through the command line.

You’ve noticed my preference for keytool-explorer. It is a great tool that makes working with keys and keystores easy and predictable, as opposed to command-line tools like keytool and OpenSSL, which I’m sure nobody is able to use without googling every single command. Of course, if you have to do very specific or odd stuff, you’ll have to revert to the command line, but for most operation,s the UI is sufficient (unless you have to automate it, in which case, obviously, use the CLI).

You’d rarely need to do what I’ve shown above, but in case you have to, I hope the hints above were useful.